Nelgin was born in England and moved to the US in 1996. He's fluent in both English English and American English :)

His hobbies include visiting bars and trying different beers, socializing, traveling, music, and astronomy.

He owns an 8“ Newtownian telescope.

He plays keyboards, guitar, and drums for fun.

His aim is to visit all 50 states. He's visited 36 37 so far.

End Of The Line BBS is run by Nelgin

http://www.endofthelinebbs.com

telnet://endofthelinebbs.com

ssh://endofthelinebbs.com

rlogin://endofthelinebbs.com

Point a viewdata emulator at endofthelinebbs.com port 6502 to try the experimental interface.

This works for me. It might not work for you. It's easier to do all this as root and then chown/chmod files as necessary to secure them. This works on Ubuntu.

First I created a dns entry mqtt.endofthelinebbs.com to point to my server IP address. You could probably use your regular dns name or something else, I'm not sure. I just know this works for me. Obviously, don't use endofthelinebbs.com but your own domain name throughout. Your certs are not going to work on my mqtt server!

Next, I decided to create a password for my bbs user for extra security.

In /etc/mosquitto create a pwfile file with a username:password line

  bbs:mypasswd
  

Now, convert the file

  mosquitto_passwd -U pwfile
  

This will upgrade the file and hash the plain text password. Never run -U on an already hashed password file or it'll rehash the hashed password!

In your /etc/mosquitto/certs directory:

Create your CA

  openssl genrsa -des3 -out ca.key 2048

Enter a passphrase you'll remember. You'll need this to sign your certs.

Now create your ca.crt

  openssl req -new -x509 -days 36500  -key ca.key -out ca.crt
  

For Common Name, I just entered the domain, endofthelinebbs.com

Create a server.key

  openssl genrsa -out server.key 2048

Now the csr

  openssl req -new -out server.csr -key server.key

Here I use mqtt.endofthelinebbs.com as the Common Name. This is what we'll use to connect to the mqtt service.

Now create the crt

  openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 36500   

Create /etc/mosquitto/conf.d/sbbs.conf

  allow_anonymous false
  password_file /etc/mosquitto/pwfile
  log_type debug
  # mqtt protocol standard port
  listener 1883
  # mqtt protocol ssl port
  listener 8883
  tls_version tlsv1.2
  cafile /etc/mosquitto/certs/ca.crt
  certfile /etc/mosquitto/certs/server.crt
  keyfile /etc/mosquitto/certs/server.key
  require_certificate true
  use_identity_as_username false
  # websocket protocol standard port
  listener 1884
  protocol websockets
  socket_domain ipv4
  # websocket protocol ssl port
  listener 8884
  protocol websockets
  socket_domain ipv4
  cafile /etc/mosquitto/certs/ca.crt
  certfile /etc/mosquitto/certs/server.crt
  keyfile /etc/mosquitto/certs/server.key
  require_certificate true
  use_identity_as_username false
  

chown mosquitto. /etc/mosquitto/certs/* /etc/mosquitto/conf.d/sbbs.conf /etc/mosquitto/pwfile chmod 640 /sbbs/mosquitto/certs/* /etc/mosquitto/pwfile

Now start or restart your mosquitto service

  systemctl restart mosquitto
  or
  systemctl start mosquitto
  

Check /var/log/mosquitto/mosquitto.log to see if its running

  1702534680: mosquitto version 2.0.11 starting
  1702534680: Config loaded from /etc/mosquitto/mosquitto.conf.
  1702534680: Opening ipv4 listen socket on port 1883.
  1702534680: Opening ipv6 listen socket on port 1883.
  1702534680: Opening ipv4 listen socket on port 8883.
  1702534680: Opening ipv6 listen socket on port 8883.
  1702534680: Opening websockets listen socket on port 1884.
  1702534680: Opening websockets listen socket on port 8884.
  1702534680: mosquitto version 2.0.11 running
  

If all is good you can now make your sbbs certs.

Create your key

  cd /etc/mosquitto/certs
  openssl genrsa -out  sbbs_mqtt.key 2048

Create your csr

  openssl req -new -out sbbs_mqtt.csr -key  sbbs_mqtt.key

For Common Name, I use the BBS hostname, bbs.endofthelinebbs.com Create your crt

  openssl x509 -req -in sbbs_mqtt.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out  sbbs_mqtt.crt  -days 36500
  

copy the /etc/mosquitto/certs/ca.crt file and move the sbbs_mqtt files to /sbbs/ctrl

  cp /etc/mosquitto/certs/ca.crt /sbbs/ctrl
  mv /etc/mosquitto/certs/sbbs_mqtt.* /sbbs/ctrl
  cd /sbbs/ctrl
  chown bbsuser:bbsgroup ca.crt sbbs_mqtt.*

Replacing bbsuser and bbsgroup with the username/group of your bbs user.

use scfg to configure your MTQQ accordingly, use port 8883, hostname is mqtt.endofthelinebbs.com and select TLS.

[MQTT]
Enabled=true
Verbose=true
Broker_addr=mqtt.endofthelinebbs.com
Broker_port=8883
Protocol_version=5
Keepalive=11
Publish_QOS=0
Subscribe_QOS=2
Username=bbs
Password=xxxxxxxxx
LogLevel=Debugging
TLS_mode=1
TLS_cafile=/sbbs/ctrl/ca.crt
TLS_certfile=/sbbs/ctrl/sbbs_mqtt.crt
TLS_keyfile=/sbbs/ctrl/sbbs_mqtt.key
TLS_keypass=
TLS_psk=
TLS_identity=

You'll need to restart sbbs. I found that if it's already connected to port 1883 then it won't establish a new connection.

If you're lucky, your logfile will show sbbs connected:

  1702583738: New client connected from 192.138.210.158:59382 as sbbs-EOTLBBS-bbs.endofthelinebbs.com-web (p5, c1, k11, u'bbs').

This is a very rough draft of what worked for me on my Ubuntu 22.04.3 with the latest build of Synchronet.